Claude Code 2.1.257 closes several ways a permission rule could be walked around

The release notes for Claude Code 2.1.257, published on September 1, 2026, read as a pass over the permission system rather than a feature list. Auto mode gained a rule aimed at containment escapes, five deny rules turned out not to cover the commands they were written for, and a file checked into a repository can no longer switch a whole session into bypass mode.

What auto mode stops approving on its own

The new Containment Escape rule covers three moves: fetching cloud metadata credentials, evading egress controls, and reaching across tenants. None of them are auto-approved any more unless the environment marks them as expected. These are the actions an agent takes when it is trying to get out of the box it was put in, whether it got there by itself or because a page it read told it to.

The second change is quieter and matters more day to day. Auto mode now shows a one-time prompt before the first file read outside the working directories, and permissions.blockReadsOutsideWorkingDirectories can refuse such reads outright. Until now a session could read anything the account could read, and nothing in the interface said so.

Deny rules that were not denying

Five fixes in this release have the same shape. A permission rule existed, and one particular way of writing the command went past it.

One setting changed meaning as well. defaultMode: "bypassPermissions" in a project's .claude/settings.json or .claude/settings.local.json is now ignored, the same way "auto" already was. A file committed to a repository can no longer decide that everyone who opens it works without permission prompts; that belongs in user settings, in managed settings, or on the command line.

• A permissions.ask rule was skipped in auto mode when the matching command ran inside a compound command or a subshell, so it ran with no prompt at all.
• Bash Read() and Edit() deny rules did not apply to < file redirects or to reader commands such as tac and egrep; a deny rule on any argument or redirect target now refuses the command.
• A sandbox network host written with a trailing dot, example.com., was not blocked by the matching deniedDomains entry.
• Dismissing the Remote Control consent prompt counted as consent, so the next request connected without asking again.
• A plugin could read files outside its own directory through a declared command, agent, skill or hook path that was a symlink; such paths are now refused with an error.

Fable 5.1 as the default, and a launch that had broken

The same release adds Claude Fable 5.1 as the default model in that line, with a one-million-token context window. It is priced at 10 dollars per million input tokens and 50 dollars per million output tokens, with cache reads at 0.25 dollars per million tokens. In Claude apps gateway sessions, fable and best keep resolving to Fable 5 for now, because gateways not yet configured for the new model reject it.

Version 2.1.258 followed a few hours later with two fixes that restore basic operation. Claude Code was failing to launch on macOS 12, a regression introduced in 2.1.255, and remote and scheduled sessions were failing after a re-sent permission approval could not be applied.